Discovery Configuration
About 15% of the CIS-SM exam — see all 6 domains.
Service Mapping rides on the same infrastructure as Discovery, so a CIS-SM candidate must know the Discovery plumbing.
MID Server
The MID Server (Management, Instrumentation, and Discovery) is the Java application, installed inside the customer network, that executes all probes, patterns, and commands on the candidate's behalf and returns results to the instance. For Service Mapping you must:
- Configure MID Servers (often in clusters for capacity and high availability) with line-of-sight to the targets being mapped.
- Confirm the MID Server has the capabilities and applications assigned for the technologies it will discover.
- Know that Service Mapping reads specific MID Server parameters/properties during discovery and mapping; defaults should not be changed unless troubleshooting.
Credentials
Discovery and mapping require credentials stored in the instance credential store (SSH/SNMP for hosts, Windows credentials via PowerShell/WMI, plus application and cloud credentials). Before mapping, verify that every host and application credential needed along a service's dependency chain is present — missing credentials are a leading cause of stalled maps.
Verifying readiness
Use the built-in "verify Service Mapping is set up properly" check before mapping: it confirms MID Servers are configured to discover application services and that host and application credentials are in place. This readiness check is a recurring exam theme — know that it exists and what it validates.
Patterns are shared
The same Discovery and Service Mapping Patterns drive both horizontal Discovery (CI attributes) and top-down Service Mapping (connections). Keep them installed and current from the Store.
Fast-recall — Domain 3
- MID Server executes probes/patterns/commands inside the network; deploy in clusters with line-of-sight.
- Assign correct capabilities/applications; respect default MID Server parameters unless troubleshooting.
- Credentials (SSH/SNMP/Windows/app/cloud) must cover the whole dependency chain.
- Run the readiness verification before mapping (checks MID Servers + credentials).
- Discovery and Service Mapping share the same pattern set.
Sample questions from this domain
Three of the 45 in this domain, with the reasoning. The full set is in the question bank.
What is the primary function of a Discovery Schedule?
- A. To render service maps
- B. To store credentials
- C. To define when and what (IP ranges or CIs) Discovery runs against using a MID Server ✓
- D. To create events
Why: A Discovery Schedule defines the timing and scope (IP ranges/CIs) of a Discovery run via a MID Server. It does not store credentials, render maps, or create events.
Which Discovery phase determines whether a device is alive and what type it is before deeper probing?
- A. Classification
- B. Scanning (Shazzam) and then Classification ✓
- C. Exploration
- D. Identification only
Why: Discovery first scans with the Shazzam probe to find active devices and open ports, then classifies the device type before exploration and identification. Exploration and identification come later; classification alone is incomplete.
What does the Shazzam probe primarily do?
- A. Reads the CMDB
- B. Creates business services
- C. Performs a port scan across the target IP ranges to detect active services ✓
- D. Sends Event Management alerts
Why: Shazzam port-scans the target ranges to detect active services and open ports. It does not read the CMDB, create services, or send alerts.